feat: security headers for apps

apps/autonolas-registry/middleware.ts

@@ -1,150 +1,4 @@
-import nextSafe from 'next-safe';
-import { NextRequest, NextResponse, userAgent } from 'next/server';
+import { config, middleware } from 'libs/common-middleware/src';
 
-import prohibitedCountries from 'libs/util-prohibited-data/src/lib/prohibited-countries.json';
-
-const prohibitedCountriesCode = Object.values(prohibitedCountries);
-
-const isDev = process.env.NODE_ENV !== 'production';
-
-const getCspHeader = (browserName?: string) => {
-  if (!process.env.NEXT_PUBLIC_AUTONOLAS_SUB_GRAPH_URL) return [];
-
-  const walletconnectSrc = ['https://verify.walletconnect.org', 'https://verify.walletconnect.com'];
-
-  const connectSrc: CSPDirective = [
-    "'self'",
-    ...walletconnectSrc,
-    'https://*.olas.network/',
-    'https://*.autonolas.tech/',
-    'https://rpc.walletconnect.com/',
-    'wss://relay.walletconnect.org/',
-    'wss://relay.walletconnect.com/',
-    'https://explorer-api.walletconnect.com/',
-    'https://eth-mainnet.g.alchemy.com/v2/',
-    'https://eth-goerli.g.alchemy.com/v2/',
-    'https://gno.getblock.io/',
-    'https://polygon-mainnet.g.alchemy.com/v2/',
-    'https://polygon-mumbai-bor.publicnode.com/',
-    'https://rpc.chiado.gnosis.gateway.fm/',
-    'https://safe-transaction-mainnet.safe.global/api/v1/',
-    'https://safe-transaction-goerli.safe.global/api/',
-    'https://safe-transaction-gnosis-chain.safe.global/api/',
-    'https://safe-transaction-polygon.safe.global/api/',
-    'https://vercel.live/',
-    'https://api.devnet.solana.com/',
-    'wss://api.devnet.solana.com/',
-    'https://api.mainnet-beta.solana.com/',
-    'wss://api.mainnet-beta.solana.com/',
-    'https://holy-convincing-bird.solana-mainnet.quiknode.pro/',
-    'wss://holy-convincing-bird.solana-mainnet.quiknode.pro/',
-    'https://arb1.arbitrum.io/rpc/',
-    'https://sepolia-rollup.arbitrum.io/rpc',
-    'https://rpc.gnosischain.com/',
-    'https://mainnet.base.org/',
-    'https://sepolia.base.org/',
-    'https://mainnet.optimism.io',
-    'https://sepolia.optimism.io/',
-    'https://forno.celo.org',
-    'https://alfajores-forno.celo-testnet.org',
-    'https://api.web3modal.com/',
-    'wss://www.walletlink.org/rpc',
-    'wss://*.pusher.com/',
-    process.env.NEXT_PUBLIC_AUTONOLAS_SUB_GRAPH_URL,
-  ];
-
-  if (isDev) {
-    connectSrc.push('http://localhost');
-    connectSrc.push('ws://localhost');
-  }
-
-  const scriptSrc = ["'self'", 'https://vercel.live/', 'https://fonts.googleapis.com/'];
-
-  // Firefox blocks inline scripts by default and it's an issue with Metamask
-  // reference: https://github.com/MetaMask/metamask-extension/issues/3133
-  if (browserName === 'Firefox') {
-    scriptSrc.push("'unsafe-inline'");
-  }
-
-  const nextSafeHeaders =
-    typeof nextSafe === 'function'
-      ? // TODO
-        // @ts-expect-error: For some reason, TypeScript is not recognizing the function
-        nextSafe({
-          isDev,
-          /**
-           * Content Security Policy
-           * @see https://content-security-policy.com/
-           */
-          contentSecurityPolicy: {
-            'default-src': "'none'",
-            'script-src': scriptSrc,
-            'connect-src': connectSrc,
-            'img-src': [
-              "'self'",
-              'blob:',
-              'data:',
-              'https://*.autonolas.tech/',
-              'https://explorer-api.walletconnect.com/w3m/',
-              ...walletconnectSrc,
-            ],
-            'style-src': ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com/'],
-            'frame-src': ["'self'", 'https://vercel.live/', ...walletconnectSrc],
-          },
-          permissionsPolicyDirectiveSupport: ['standard'],
-        })
-      : [];
-
-  const headers = [
-    ...nextSafeHeaders,
-    {
-      key: 'Strict-Transport-Security',
-      value: 'max-age=31536000; includeSubDomains',
-    },
-  ];
-
-  return headers;
-};
-
-const getRedirectUrl = (pathName: string, countryName?: string) => {
-  const isProhibited = countryName ? prohibitedCountriesCode.includes(countryName) : false;
-
-  if (pathName === '/not-legal') {
-    return isProhibited ? null : '/';
-  }
-  return isProhibited ? '/not-legal' : null;
-};
-
-export default async function middleware(request: NextRequest) {
-  const country = request.geo?.country;
-  const redirectUrl = getRedirectUrl(request.nextUrl.pathname, country);
-
-  const response = redirectUrl
-    ? NextResponse.redirect(new URL(redirectUrl, request.nextUrl))
-    : NextResponse.next();
-
-  const browserName = userAgent(request)?.browser.name;
-  const cspHeaders = getCspHeader(browserName);
-
-  // apply CSP headers
-  // https://nextjs.org/docs/app/building-your-application/routing/middleware#setting-headers
-  cspHeaders.forEach((header) => {
-    const { key, value } = header;
-    response.headers.set(key, value);
-  });
-
-  return response;
-}
-
-export const config = {
-  matcher: [
-    /*
-     * Match all request paths except for the ones starting with:
-     * - api (API routes)
-     * - _next/static (static files)
-     * - _next/image (image optimization files)
-     * - favicon.ico (favicon file)
-     */
-    '/((?!api|_next/static|_next/image|favicon.ico).*)',
-  ],
-};
+export default middleware;
+export { config };

apps/bond/middleware.ts

@@ -0,0 +1,4 @@
+import { config, middleware } from 'libs/common-middleware/src';
+
+export default middleware;
+export { config };

apps/bond/next.config.js

@@ -24,41 +24,6 @@ const nextConfig = {
     };
     return config;
   },
-  async headers() {
-    return [
-      {
-        source: '/:path*',
-        headers: [
-          {
-            key: 'Content-Security-Policy',
-            value: "frame-ancestors 'none';",
-          },
-          {
-            key: 'X-Content-Type-Options',
-            value: 'nosniff',
-          },
-          {
-            key: 'Referrer-Policy',
-            value: 'strict-origin-when-cross-origin',
-          },
-          {
-            key: 'Strict-Transport-Security',
-            value: 'max-age=31536000; includeSubDomains',
-          },
-        ],
-      },
-      {
-        source: '/:all*(svg|jpg|jpeg|png|gif|ico|css|js|mov|mp4)',
-        headers: [
-          {
-            key: 'Cache-Control',
-            value: 'public, max-age=31536000, must-revalidate',
-          },
-        ],
-      },
-    ];
-  },
-
 };
 
 const plugins = [

apps/govern/middleware.ts

@@ -0,0 +1,4 @@
+import { config, middleware } from 'libs/common-middleware/src';
+
+export default middleware;
+export { config };

apps/launch/middleware.ts

@@ -0,0 +1,4 @@
+import { config, middleware } from 'libs/common-middleware/src';
+
+export default middleware;
+export { config };

apps/tokenomics/middleware.ts

@@ -0,0 +1,4 @@
+import { config, middleware } from 'libs/common-middleware/src';
+
+export default middleware;
+export { config };

apps/tokenomics/next.config.js

@@ -40,31 +40,6 @@ const nextConfig = {
       },
     ];
   },
-  async headers() {
-    return [
-      {
-        source: '/:path*',
-        headers: [
-          {
-            key: 'Content-Security-Policy',
-            value: "frame-ancestors 'none';",
-          },
-          {
-            key: 'X-Content-Type-Options',
-            value: 'nosniff',
-          },
-          {
-            key: 'Referrer-Policy',
-            value: 'strict-origin-when-cross-origin',
-          },
-          {
-            key: 'Strict-Transport-Security',
-            value: 'max-age=31536000; includeSubDomains',
-          },
-        ],
-      },
-    ];
-  },
 };
 const plugins = [
   // Add more Next.js plugins to this list if needed.

libs/common-middleware/.eslintrc.json

@@ -0,0 +1,18 @@
+{
+  "extends": ["plugin:@nx/react", "../../.eslintrc.json"],
+  "ignorePatterns": ["!**/*"],
+  "overrides": [
+    {
+      "files": ["*.ts", "*.tsx", "*.js", "*.jsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.ts", "*.tsx"],
+      "rules": {}
+    },
+    {
+      "files": ["*.js", "*.jsx"],
+      "rules": {}
+    }
+  ]
+}

libs/common-middleware/README.md

@@ -0,0 +1,5 @@
+# common-middleware
+
+Common middleware for apps, including:
+- Prohibition of specific countries and addresses
+- Implementation of security headers

libs/common-middleware/project.json

@@ -0,0 +1,13 @@
+{
+  "name": "common-middleware",
+  "$schema": "../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "libs/common-middleware/src",
+  "projectType": "library",
+  "tags": [],
+  "targets": {
+    "lint": {
+      "executor": "@nx/eslint:lint",
+      "outputs": ["{options.outputFile}"]
+    }
+  }
+}

libs/common-middleware/src/index.ts

@@ -0,0 +1 @@
+export { config, middleware } from './middleware';